@productbrain/cli 0.1.0-beta.98 → 0.1.0-beta.9817

package/dist/lib/client.d.ts

@@ -1,29 +1,27 @@
 /**
  * MCP HTTP client — POST to Convex gateway with Bearer auth.
  *
- * TEN-729: Detects sandbox-blocked fetch (Claude Code, Cursor, etc.) and
- * provides an actionable error instead of the opaque "fetch failed".
+ * TEN-729: Detects sandbox-blocked fetch (Claude Code, Cursor, etc.) and provides an
+ * actionable error instead of the opaque "fetch failed".
  *
- * Sandbox proxy support: Node.js fetch (undici) ignores proxy env vars by
- * default. We detect HTTPS_PROXY and configure a ProxyAgent so pb works in
- * sandboxed environments (Claude Code, Cursor) without requiring
- * NODE_OPTIONS="--use-env-proxy".
+ * Sandbox proxy support: Node.js fetch (undici) ignores proxy env vars by default. We detect
+ * HTTPS_PROXY and configure a ProxyAgent so pb works in sandboxed environments (Claude Code,
+ * Cursor) without requiring NODE_OPTIONS="--use-env-proxy".
  */
+import type { ValidationErrorDetail } from './kernelEnvelope.js';
 import { CLIError } from './errors.js';
-/** Structured field-level detail from a VALIDATION_FAILED response. */
-export interface ValidationErrorDetail {
-    fieldKey: string;
-    fieldLabel: string;
-    invalidValue: unknown;
-    validOptions?: string[];
-    errorType: 'type_mismatch' | 'invalid_option' | 'required';
-    message: string;
-}
+import { type KernelCallOptions } from './rate-limit.js';
+export declare function isPerEntryAuthorizationRefusal(code?: string): boolean;
 /** Error thrown by kernelCall/kernelCallWithSession when the server returns a non-OK response. */
 export declare class McpError extends CLIError {
     details?: ValidationErrorDetail[];
-    constructor(message: string, code?: string, details?: ValidationErrorDetail[]);
+    /** Present only when code === 'rate-limited' — seconds until the caller may retry. */
+    retryAfterSeconds?: number;
+    missingRequiredFields?: string[];
+    constructor(message: string, code?: string, details?: ValidationErrorDetail[], retryAfterSeconds?: number, missingRequiredFields?: string[]);
 }
+export { resetTouchThrottle, type KernelCallOptions } from './rate-limit.js';
+export type { KernelEnvelope, ValidationErrorDetail } from './kernelEnvelope.js';
 /** Result of validateKey — used by `pb login` to verify a key before saving. */
 export type ValidateKeyResult = {
     valid: true;
@@ -39,6 +37,15 @@ export type ValidateKeyResult = {
  * Returns { valid: true, workspaceId } on success.
  * Returns { valid: false, error } on auth failure (401) or other server error.
  * Throws on network/timeout errors so the caller can distinguish "bad key" from "can't reach server".
+ *
+ * WP-575: `timeoutMs` now DEFAULTS to `resolveWorkspace`'s declared budget instead of a
+ * local `5000` literal — that literal was the last connector-owned timeout on the gateway
+ * path, and the point of this work package is that no connector gets to pick its own. It
+ * stays an explicit parameter so a caller (or a test) can still override deliberately.
+ * Widening 5s -> the declared 10s costs nothing in the case people actually hit: an
+ * unreachable host fails with ECONNREFUSED/ENOTFOUND immediately, not by timeout. The
+ * timeout only governs a server that ACCEPTS the connection then stalls, where waiting the
+ * route's real declared budget before calling the key invalid is the correct behavior.
  */
 export declare function validateKey(apiKey: string, siteUrl: string, timeoutMs?: number): Promise<ValidateKeyResult>;
 /** Get a human-friendly spinner label for an MCP function name. */
@@ -51,16 +58,37 @@ export declare function spinnerLabel(fn: string): string;
  * Throws CLIError on auth failure or non-OK response.
  */
 export declare function adminCall(command: string, args?: Record<string, unknown>): Promise<unknown>;
-export declare function kernelCall<T = unknown>(fn: string, args?: Record<string, unknown>): Promise<T>;
+export declare function kernelCall<T = unknown>(fn: string, args?: Record<string, unknown>, options?: KernelCallOptions): Promise<T>;
 /**
- * kernelCall variant that injects X-Agent-Session-Id header for write operations.
+ * kernelCall variant that returns the full kernel envelope (data + summary + _meta) instead
+ * of stripping to just `data` — mirrors packages/mcp-server/src/client.ts's
+ * `kernelCallEnvelope`. Use when a caller needs `_meta` (e.g. a route-specific additive
+ * flag like chain.shapeAdvisories' `truncated`, WP-571 sweep) without changing `data`'s own
+ * shape — the reason `_meta` exists as a side-channel at all (convex/lib/envelopeContract.ts).
+ */
+export declare function kernelCallEnvelope<T = unknown>(fn: string, args?: Record<string, unknown>, options?: KernelCallOptions): Promise<{
+    data: T;
+    summary?: string;
+    _meta?: {
+        durationMs?: number;
+        truncated?: boolean;
+    };
+}>;
+/**
+ * kernelCall variant for write operations. Callers that need server-side session
+ * validation (e.g. `chain.verifyEntry`) pass `sessionId` in `args` explicitly —
+ * it now travels in the request body, not a header (http.ts never read the old
+ * `X-Agent-Session-Id` header).
  * All write commands (update, relate, unrelate, capture) should use this.
  *
+ * WP-711/712: the binding guard lives in the shared fetchKernelEnvelope. TEN-3398 (follow-up)
+ * added the effective-tenant notice here too, alongside the post-write session-touch below.
+ *
  * After a successful write, fires a non-blocking `agent.touchSession` call to
  * renew the session TTL — mirroring MCP server behavior (DEC-299, BET-181 Slice 1).
  * The touch is fire-and-forget: it does not block the write response, and errors
  * are silently swallowed. No touch is attempted if no session is active or if
  * the write itself fails.
  */
-export declare function kernelCallWithSession<T = unknown>(fn: string, args?: Record<string, unknown>): Promise<T>;
+export declare function kernelCallWithSession<T = unknown>(fn: string, args?: Record<string, unknown>, options?: KernelCallOptions): Promise<T>;
 //# sourceMappingURL=client.d.ts.map

package/dist/lib/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,QAAQ,EAAa,MAAM,aAAa,CAAC;AAIlD,uEAAuE;AACvE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,eAAe,GAAG,gBAAgB,GAAG,UAAU,CAAC;IAC3D,OAAO,EAAE,MAAM,CAAC;CACjB;AAeD,kGAAkG;AAClG,qBAAa,QAAS,SAAQ,QAAQ;IACpC,OAAO,CAAC,EAAE,qBAAqB,EAAE,CAAC;gBAEtB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,EAAE;CAQ9E;AAwCD,gFAAgF;AAChF,MAAM,MAAM,iBAAiB,GACzB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpC;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,SAAS,SAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CAmC5B;AA0BD,mEAAmE;AACnE,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,OAAO,CAAC,CAsBlB;AAED,wBAAsB,UAAU,CAAC,CAAC,GAAG,OAAO,EAC1C,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,CAAC,CAAC,CAyBZ;AA0BD;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,GAAG,OAAO,EACrD,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,CAAC,CAAC,CAwCZ"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH,OAAO,KAAK,EAAkB,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAMjF,OAAO,EAAE,QAAQ,EAAa,MAAM,aAAa,CAAC;AAGlD,OAAO,EAAkC,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAoBzF,wBAAgB,8BAA8B,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAErE;AAkCD,kGAAkG;AAClG,qBAAa,QAAS,SAAQ,QAAQ;IACpC,OAAO,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAClC,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;gBAEjD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,EAAE,EAAE,iBAAiB,CAAC,EAAE,MAAM,EAAE,qBAAqB,CAAC,EAAE,MAAM,EAAE;CAc5I;AAGD,OAAO,EAAE,kBAAkB,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAK7E,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAoDjF,gFAAgF;AAChF,MAAM,MAAM,iBAAiB,GACzB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,SAAS,SAA8C,GACtD,OAAO,CAAC,iBAAiB,CAAC,CAqC5B;AA6BD,mEAAmE;AACnE,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,OAAO,CAAC,CAoClB;AAqFD,wBAAsB,UAAU,CAAC,CAAC,GAAG,OAAO,EAC1C,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EAClC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,CAAC,CAAC,CAIZ;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,GAAG,OAAO,EAClD,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EAClC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC;IAAE,IAAI,EAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAAC,CAI9F;AA+BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,GAAG,OAAO,EACrD,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EAClC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,CAAC,CAAC,CA8BZ"}

package/dist/lib/client.js

@@ -1,46 +1,110 @@
 /**
  * MCP HTTP client — POST to Convex gateway with Bearer auth.
  *
- * TEN-729: Detects sandbox-blocked fetch (Claude Code, Cursor, etc.) and
- * provides an actionable error instead of the opaque "fetch failed".
+ * TEN-729: Detects sandbox-blocked fetch (Claude Code, Cursor, etc.) and provides an
+ * actionable error instead of the opaque "fetch failed".
  *
- * Sandbox proxy support: Node.js fetch (undici) ignores proxy env vars by
- * default. We detect HTTPS_PROXY and configure a ProxyAgent so pb works in
- * sandboxed environments (Claude Code, Cursor) without requiring
- * NODE_OPTIONS="--use-env-proxy".
+ * Sandbox proxy support: Node.js fetch (undici) ignores proxy env vars by default. We detect
+ * HTTPS_PROXY and configure a ProxyAgent so pb works in sandboxed environments (Claude Code,
+ * Cursor) without requiring NODE_OPTIONS="--use-env-proxy".
  */
-import { getConfig, resolveAdminConfig } from './config.js';
-import { readSession } from './session.js';
+// WP-575 (TEN-2917): every gateway call is bounded by the budget DECLARED at the route
+// contract — see ./gatewayTimeout.ts for why a copy, and why the CLI had none before.
+import { latencyBudgetMsForRoute } from '../generated/routeLatencyBudget.generated.js';
+import { ORGANISATIONAL_AUTHORITY_REFUSAL_CODES as ORGANISATIONAL_AUTHORITY_REFUSAL_CODES_LIST } from '../generated/organisationalAuthorityRefusalCodes.generated.js';
+import { gatewayTimeoutError, isTimeoutAbort } from './gatewayTimeout.js';
+// The envelope's shape and how to read one off a Response — including the body-phase budget
+// abort (WP-575 review). Split out under STD-2/DEC-1504; see ./kernelEnvelope.ts's header for
+// why the seam is real and not a line-count dodge.
+import { parseKernelEnvelope, recordLatestFromResponse, authorityFromDetails } from './kernelEnvelope.js';
+import { getConfig } from './config.js';
+import { resolveAdminConfig } from './adminConfig.js';
+import { emitEffectiveTenantNotice, describeCurrentTenantForRefusal, guardAdminCall } from './workspaceNotice.js';
+import { readSession, readSessionBySessionId } from './session.js';
+import { assertSessionStillBound, fingerprintOf } from './sessionBinding.js';
 import { CLIError, ErrorCode } from './errors.js';
 import { withSpinner } from './spinner.js';
-/**
- * Map MCP server error codes to CLIError categories.
- * Keeps backward compat: McpError.code is still a free string from the server,
- * but category and guidance are derived for the global error handler.
- */
+import { maybeRetry, shouldTouchSession } from './rate-limit.js';
+/** Map MCP server error codes to CLIError categories. Keeps backward compat: McpError.code is
+ * still a free string from the server, but category and guidance are derived for the handler. */
+// WP-753 O5a fix round 1 (item 5/8): GENERATED from kernel/organisationalAuthority/types.ts's `OrganisationalAuthorityRefusal` union via generate-kernel-value-sets.mjs (no more hand-sync) — a thrown org-authority refusal (http.ts's category:'auth' branch) arrives as one of these, none 'AUTH'-prefixed, so it fell through to 'internal' (found live on O5a's own preview walk: pb unrelate showed the real reason but the wrong category).
+const ORGANISATIONAL_AUTHORITY_REFUSAL_CODES = new Set(ORGANISATIONAL_AUTHORITY_REFUSAL_CODES_LIST);
+// WP-753 O5a fix round 2 (MAJOR) + round 3: category 'auth' is right, but entryAccept.ts's batch
+// abort predicate conflated "fails every id identically" with "category is auth" — an
+// org-authority refusal is PER-ENTRY (entry B's ownership is unrelated to A/C), unlike a real
+// credential failure, so this is excluded from entryAccept.ts's GLOBAL_PRECONDITION_CATEGORIES
+// rethrow, keeping INS-1813's "one bad id never aborts the batch" true for 'auth' too — EXCEPT
+// the actor-wide codes (`actor_inactive`, `no_role`, `multi_role`), each a GLOBAL precondition (judge.ts:12 refuses on !facts.actorIsActive
+// before any entry-specific check, managementJudge.ts:16 same shape), which still aborts. No
+// `code === 'AUTHZ_PERMISSION_DENIED'` clause: it could never match (normalizeMcpCode below
+// folds every AUTHZ_* code to ErrorCode.AUTH_DENIED, errors.test.ts:121-123 asserts it).
+// Recorded gap, not fixed here (TEN-3687): the per-entry authority BLOCK on this same route
+// (entries.ts:2284-2289, no propose_change) also arrives as AUTH_DENIED and still aborts a
+// batch, since AUTH_DENIED is overloaded with genuinely global denials too (http.ts:896-899, :918-922) — no serverCode field to split them.
+const ACTOR_GLOBAL_REFUSALS = new Set(['actor_inactive', 'no_role', 'multi_role']);
+export function isPerEntryAuthorizationRefusal(code) {
+    return Boolean(code) && !ACTOR_GLOBAL_REFUSALS.has(code) && ORGANISATIONAL_AUTHORITY_REFUSAL_CODES.has(code);
+}
 function mcpCodeToCategory(code) {
     if (!code)
         return 'internal';
-    if (code.startsWith('AUTH') || code === 'UNAUTHORIZED')
+    if (code.startsWith('AUTH') || code === 'UNAUTHORIZED' || ORGANISATIONAL_AUTHORITY_REFUSAL_CODES.has(code) || code === ErrorCode.ROLE_SWITCH_REFUSED)
         return 'auth';
-    if (code === 'VALIDATION_FAILED' || code === 'QUALITY_GATE_BLOCKED')
+    if (code === 'VALIDATION_FAILED' || code === 'QUALITY_GATE_BLOCKED' ||
+        code === 'GROUNDING_GATE_BLOCKED' || code === 'SEMANTIC_QUALITY_GATE_BLOCKED' || code === 'CONTRADICTION_BLOCKED' || code === 'STRATEGY_SINGLETON_BLOCKED' ||
+        // WP-477 / FEAT-1350: both are 400s the caller fixes by changing an argument (pass the issued cursor verbatim / ask for a smaller numItems) — not internal faults.
+        code === 'CURSOR_QUERY_MISMATCH' || code === 'PAGE_SPLIT_REQUIRED' ||
+        // TEN-2647: Convex's own arg-validator rejection — a 400 the caller fixes by correcting the offending argument (missing/unknown/wrong-typed), not an internal fault.
+        code === 'ARGUMENT_VALIDATION_FAILED' || code === 'CHANGE_REASON_REQUIRED' || // TASK-381: the caller fixes it by passing --change-reason
+        // WP-494 (TEN-2742): `pb feedback submit` refused because the workspace switched off agent-submitted feedback — a policy gate, not an internal fault (mirrors the GATE_BLOCKED family above).
+        code === 'AGENT_FEEDBACK_DISABLED')
         return 'validation';
     if (code === 'SESSION_REQUIRED')
         return 'session';
+    // TEN-656: per-key API quota — a 429 the caller fixes by WAITING, not by changing the
+    // call. Categorized as network so the global handler renders it as retryable, never
+    // as an internal fault.
+    if (code === 'rate-limited')
+        return 'network';
     return 'internal';
 }
+function normalizeMcpCode(code) {
+    // Convex names the internal protocol condition; the public CLI exposes its stable,
+    // harness-independent error taxonomy to people and agents. WP-584 S4 review round 1 (P2-3):
+    // the WHOLE AUTHZ_* family maps here, not just AUTHZ_PERMISSION_DENIED — a narrower match let
+    // AUTHZ_INSUFFICIENT_ROLE (BR-227's own code, convex/http.ts's vendor-gate 403) fall through
+    // the `as` cast below and publish Convex's raw internal code as a real CLI ErrorCodeValue.
+    // Mirrors mcpCodeToCategory's own `code.startsWith('AUTH')` breadth, above.
+    if (code?.startsWith('AUTHZ_'))
+        return ErrorCode.AUTH_DENIED;
+    if (code === 'CHANGE_REASON_REQUIRED')
+        return ErrorCode.VALIDATION_FAILED; // TASK-381: caller-fixable
+    return code ?? ErrorCode.INTERNAL;
+}
 /** Error thrown by kernelCall/kernelCallWithSession when the server returns a non-OK response. */
 export class McpError extends CLIError {
     details;
-    constructor(message, code, details) {
+    /** Present only when code === 'rate-limited' — seconds until the caller may retry. */
+    retryAfterSeconds;
+    missingRequiredFields; // TASK-680 (TEN-4567): the fields an accept refusal names as data
+    constructor(message, code, details, retryAfterSeconds, missingRequiredFields) {
         super(message, {
-            code: code ?? ErrorCode.INTERNAL,
+            code: normalizeMcpCode(code),
             category: mcpCodeToCategory(code),
+            // TEN-656 / TEN-2655: the rate-limit refusal must be agent-legible — say exactly what to
+            // do (wait, then retry unchanged), because autonomous chained runs have no human to interpret a bare 429.
+            guidance: code === 'rate-limited'
+                ? 'This API key hit its request quota (HTTP 429). Wait the number of seconds in the message (also in the Retry-After header), then retry the same call unchanged — it is safe to retry.'
+                : authorityFromDetails(details)?.requiredAction, authority: authorityFromDetails(details), // DEC-1851: who decides, from a thrown authority refusal's details
         });
         this.name = 'McpError';
         this.details = details;
+        this.retryAfterSeconds = retryAfterSeconds;
+        this.missingRequiredFields = missingRequiredFields;
     }
 }
+// WP-579: the rate-limit retry and touch throttle live in rate-limit.ts — self-contained policies with their own state, kept out of this module's budget (STD-2).
+export { resetTouchThrottle } from './rate-limit.js';
 // Configure proxy at module load — runs once, before any fetch call.
 // Node.js fetch (undici) ignores HTTPS_PROXY env vars. We detect the proxy
 // and install a ProxyAgent as the global dispatcher so all fetch() calls
@@ -56,8 +120,16 @@ catch {
     // undici unavailable or proxy config failed — rethrowWithGuidance handles it.
 }
 /** Detect a sandbox/network-blocked fetch and re-throw with guidance. */
-function rethrowWithGuidance(err, siteUrl) {
+function rethrowWithGuidance(err, siteUrl, 
+// WP-575: the route being called, the budget it was given, and the call's own args, so a
+// budget abort can be reported as itself rather than collapsing into "Could not reach
+// <host>" — and so a dry run is never told its write may have landed (see ./gatewayTimeout.ts).
+route) {
     const msg = err instanceof Error ? err.message : String(err);
+    // WP-575: a budget abort is not an unreachable host — the connection succeeded, we stopped
+    // waiting, and for a write route the server may have finished. See ./gatewayTimeout.ts.
+    if (route && isTimeoutAbort(err))
+        throw gatewayTimeoutError(route.fn, route.budgetMs, route.args);
     if (msg === 'fetch failed' || msg.includes('ECONNREFUSED') || msg.includes('ENOTFOUND')) {
         const host = new URL(siteUrl).hostname;
         const proxy = process.env.https_proxy || process.env.HTTPS_PROXY;
@@ -85,8 +157,17 @@ function rethrowWithGuidance(err, siteUrl) {
  * Returns { valid: true, workspaceId } on success.
  * Returns { valid: false, error } on auth failure (401) or other server error.
  * Throws on network/timeout errors so the caller can distinguish "bad key" from "can't reach server".
+ *
+ * WP-575: `timeoutMs` now DEFAULTS to `resolveWorkspace`'s declared budget instead of a
+ * local `5000` literal — that literal was the last connector-owned timeout on the gateway
+ * path, and the point of this work package is that no connector gets to pick its own. It
+ * stays an explicit parameter so a caller (or a test) can still override deliberately.
+ * Widening 5s -> the declared 10s costs nothing in the case people actually hit: an
+ * unreachable host fails with ECONNREFUSED/ENOTFOUND immediately, not by timeout. The
+ * timeout only governs a server that ACCEPTS the connection then stalls, where waiting the
+ * route's real declared budget before calling the key invalid is the correct behavior.
  */
-export async function validateKey(apiKey, siteUrl, timeoutMs = 5000) {
+export async function validateKey(apiKey, siteUrl, timeoutMs = latencyBudgetMsForRoute('resolveWorkspace')) {
     return withSpinner('Validating API key', async () => {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -101,10 +182,12 @@ export async function validateKey(apiKey, siteUrl, timeoutMs = 5000) {
                 signal: controller.signal,
             });
             clearTimeout(timer);
+            // Record header BEFORE the 401/403 short-circuit — auth-fail responses still carry the version skew signal.
+            recordLatestFromResponse(res);
             if (res.status === 401 || res.status === 403) {
                 return { valid: false, error: 'Invalid API key.' };
             }
-            const envelope = (await res.json().catch(() => ({})));
+            const envelope = await parseKernelEnvelope(res);
             if (!res.ok || envelope.ok === false) {
                 return { valid: false, error: envelope.message || envelope.error || `Server error (${res.status})` };
             }
@@ -139,6 +222,9 @@ const SPINNER_LABELS = {
     'entries.relate': 'Creating relation',
     'entries.unrelate': 'Removing relation',
     constellation: 'Loading constellation',
+    'conflicts.list': 'Loading open conflicts',
+    'conflicts.resolve': 'Recording verdict',
+    'conflicts.summary': 'Loading precision summary',
 };
 /** Get a human-friendly spinner label for an MCP function name. */
 export function spinnerLabel(fn) {
@@ -152,7 +238,20 @@ export function spinnerLabel(fn) {
  * Throws CLIError on auth failure or non-OK response.
  */
 export async function adminCall(command, args) {
-    const { apiKey, siteUrl } = resolveAdminConfig();
+    const { apiKey, siteUrl, source, profileName } = resolveAdminConfig();
+    // TEN-3398 (follow-up): `pb admin` previously carried neither the notice nor the binding
+    // guard — see workspaceNotice.ts's `guardAdminCall` doc comment for the full story.
+    guardAdminCall({ profileName, source }, boundSessionFor(args ?? {}), fingerprintOf(apiKey, siteUrl));
+    // WP-575 deliberately leaves /api/admin UNBOUNDED (PR #533 review, Codex P2 — an earlier
+    // round bounded it and that was the regression). Admin commands are long-running BULK
+    // operations (`manage:delete-workspace` cascading 100-row batches, `seed:backfill-starter`
+    // across workspaces) and are NOT in the route registry, so the fail-safe "widest" fallback
+    // is a real number for a route the contract describes and a guess for one it doesn't —
+    // an arbitrary ceiling on a destructive operation that can abort it mid-flight, which is
+    // worse than the hang it would prevent. (That fallback is whatever
+    // WIDEST_ROUTE_LATENCY_BUDGET_MS happens to be — today 330_000, since it spans the override
+    // table too — which is the point: a number that MOVES when an unrelated route's override
+    // changes is not a budget for this surface.) It needs its own MEASURED budget: follow-up work.
     let res;
     try {
         res = await fetch(`${siteUrl}/api/admin`, {
@@ -173,30 +272,96 @@ export async function adminCall(command, args) {
     }
     return response.data;
 }
-export async function kernelCall(fn, args = {}) {
+/**
+ * Connector identity for the gateway's context.served shared seam (DEC-1207). Sent as the
+ * `x-pb-source` header on gateway calls so the server-side emit can attribute this connector;
+ * the gateway defaults to `api` if it is ever absent.
+ */
+const PB_TELEMETRY_SOURCE = 'cli';
+/**
+ * Resolve the session to check the binding guard against: the ambient marker, unless `args`
+ * names a DIFFERENT session explicitly (TEN-3315 — e.g. `pb rework report --conversation A`
+ * selects a session other than the ambient one, and judging the ambient marker there would
+ * judge the wrong session). No extra IO on the ordinary path: the lookup only runs when an
+ * explicit id names a session different from the ambient marker.
+ */
+function boundSessionFor(args) {
+    const session = readSession();
+    const explicitSessionId = typeof args.sessionId === 'string' ? args.sessionId : null;
+    return explicitSessionId && explicitSessionId !== session?.sessionId
+        ? readSessionBySessionId(explicitSessionId)
+        : session;
+}
+/**
+ * The ONE gateway fetch every kernelCall path routes through (WP-711/712). Resolves config,
+ * runs the binding guard, POSTs to /api/aki, and returns the raw envelope.
+ *
+ * Before this slice only kernelCallWithSession ran assertSessionStillBound, so a moved tenant
+ * pin refused writes but not reads: `pb get`/`search`/`orient`/`context`/`brief`/`constellation`
+ * all go through plain kernelCall and silently followed a repointed pin. Two write commands
+ * (migrate-setup.ts, setup-ingest.ts) send their writes through plain kernelCall too and had
+ * each hand-duplicated the same guard call to cover that gap — exactly the "N copies of the pin
+ * cascade" shape WP-692's TEN-3239 warned about. Folding the check in here removes all three
+ * duplicates; every caller, read or write, now shares this one call site.
+ */
+async function fetchKernelEnvelope(fn, args, options) {
     const { apiKey, siteUrl } = getConfig();
+    // The ONE guard call site. `describeCurrentTenantForRefusal()` only runs inside the thunk, so
+    // it costs nothing on the ordinary (no session, or unchanged binding) path — invoked only
+    // once the guard has already decided to refuse. WP-715: names the credential ACTUALLY in
+    // play (sees an env/local/cwd-key override), never the pin it may shadow — see that
+    // function's doc comment in workspaceNotice.ts.
+    assertSessionStillBound(boundSessionFor(args), undefined, describeCurrentTenantForRefusal);
     const label = spinnerLabel(fn);
-    return withSpinner(label, async () => {
+    const budgetMs = latencyBudgetMsForRoute(fn);
+    // Spinner OUTSIDE the retry: withSpinner reports a terminal `— failed` line on any throw,
+    // so a spinner per attempt would paint up to MAX_RATE_LIMIT_RETRIES false failures for a
+    // call that ultimately succeeds, then sit silent through each Retry-After wait.
+    const envelope = await withSpinner(label, () => maybeRetry(async () => {
         let res;
         try {
             res = await fetch(`${siteUrl}/api/aki`, {
                 method: 'POST',
+                signal: AbortSignal.timeout(budgetMs),
                 headers: {
                     'Content-Type': 'application/json',
                     Authorization: `Bearer ${apiKey}`,
+                    // DEC-1207: attribute this connector for the gateway's context.served seam.
+                    'x-pb-source': PB_TELEMETRY_SOURCE,
                 },
                 body: JSON.stringify({ fn, args }),
             });
         }
         catch (err) {
-            rethrowWithGuidance(err, siteUrl);
+            rethrowWithGuidance(err, siteUrl, { fn, budgetMs, args });
         }
-        const envelope = (await res.json());
-        if (!res.ok || envelope.ok === false) {
-            throw new McpError(envelope.message || envelope.error || res.statusText, envelope.code, envelope.details);
+        const parsed = await parseKernelEnvelope(res, { fn, budgetMs, args });
+        if (!res.ok || parsed.ok === false) {
+            throw new McpError(parsed.message || parsed.error || res.statusText, parsed.code, parsed.details, parsed.retryAfterSeconds, Reflect.get(parsed, 'missingRequiredFields'));
         }
-        return envelope.data;
-    });
+        return parsed;
+    }, options));
+    // apiKey/siteUrl travel out alongside the envelope (PR #810 review, Copilot) — kernelCallWithSession
+    // needs them AFTER this resolves, for the post-write touch. Returning them here means getConfig()
+    // is called exactly ONCE per kernelCall*, never re-resolved by a caller that already has them.
+    return { envelope, apiKey, siteUrl };
+}
+export async function kernelCall(fn, args = {}, options) {
+    const { envelope } = await fetchKernelEnvelope(fn, args, options);
+    await emitEffectiveTenantNotice(); // WP-714 S3: the read path announces too (once/process).
+    return envelope.data;
+}
+/**
+ * kernelCall variant that returns the full kernel envelope (data + summary + _meta) instead
+ * of stripping to just `data` — mirrors packages/mcp-server/src/client.ts's
+ * `kernelCallEnvelope`. Use when a caller needs `_meta` (e.g. a route-specific additive
+ * flag like chain.shapeAdvisories' `truncated`, WP-571 sweep) without changing `data`'s own
+ * shape — the reason `_meta` exists as a side-channel at all (convex/lib/envelopeContract.ts).
+ */
+export async function kernelCallEnvelope(fn, args = {}, options) {
+    const { envelope } = await fetchKernelEnvelope(fn, args, options);
+    await emitEffectiveTenantNotice(); // WP-714 S3: the read path announces too (once/process).
+    return { data: envelope.data, summary: envelope.summary, _meta: envelope._meta };
 }
 /**
  * Raw fetch to the gateway — no spinner, swallows errors.
@@ -206,6 +371,11 @@ async function mcpFetchRaw(fn, args, apiKey, siteUrl) {
     try {
         await fetch(`${siteUrl}/api/aki`, {
             method: 'POST',
+            // WP-575: fire-and-forget still gets the declared budget. Errors are swallowed either
+            // way, so this is not about the message — it is about not leaving a socket and a
+            // pending promise open indefinitely on a stuck backend behind an already-returned
+            // command. "Best-effort" was never meant to mean "unbounded".
+            signal: AbortSignal.timeout(latencyBudgetMsForRoute(fn)),
             headers: {
                 'Content-Type': 'application/json',
                 Authorization: `Bearer ${apiKey}`,
@@ -218,48 +388,45 @@ async function mcpFetchRaw(fn, args, apiKey, siteUrl) {
     }
 }
 /**
- * kernelCall variant that injects X-Agent-Session-Id header for write operations.
+ * kernelCall variant for write operations. Callers that need server-side session
+ * validation (e.g. `chain.verifyEntry`) pass `sessionId` in `args` explicitly —
+ * it now travels in the request body, not a header (http.ts never read the old
+ * `X-Agent-Session-Id` header).
  * All write commands (update, relate, unrelate, capture) should use this.
  *
+ * WP-711/712: the binding guard lives in the shared fetchKernelEnvelope. TEN-3398 (follow-up)
+ * added the effective-tenant notice here too, alongside the post-write session-touch below.
+ *
  * After a successful write, fires a non-blocking `agent.touchSession` call to
  * renew the session TTL — mirroring MCP server behavior (DEC-299, BET-181 Slice 1).
  * The touch is fire-and-forget: it does not block the write response, and errors
  * are silently swallowed. No touch is attempted if no session is active or if
  * the write itself fails.
  */
-export async function kernelCallWithSession(fn, args = {}) {
-    const { apiKey, siteUrl } = getConfig();
+export async function kernelCallWithSession(fn, args = {}, options) {
+    // Ambient session, for the post-write touch below — deliberately NOT `boundSessionFor(args)`:
+    // the touch always renews the marker actually in play locally, regardless of which session an
+    // explicit `sessionId` in `args` asked the guard to validate against.
     const session = readSession();
-    const label = spinnerLabel(fn);
-    const headers = {
-        'Content-Type': 'application/json',
-        Authorization: `Bearer ${apiKey}`,
-    };
-    if (session?.sessionId) {
-        headers['X-Agent-Session-Id'] = session.sessionId;
-    }
-    const result = await withSpinner(label, async () => {
-        let res;
-        try {
-            res = await fetch(`${siteUrl}/api/aki`, {
-                method: 'POST',
-                headers,
-                body: JSON.stringify({ fn, args }),
-            });
-        }
-        catch (err) {
-            rethrowWithGuidance(err, siteUrl);
-        }
-        const envelope = (await res.json());
-        if (!res.ok || envelope.ok === false) {
-            throw new McpError(envelope.message || envelope.error || res.statusText, envelope.code, envelope.details);
-        }
-        return envelope.data;
-    });
+    // apiKey/siteUrl come back FROM fetchKernelEnvelope rather than a second getConfig() call here
+    // (PR #810 review, Copilot): the old code called getConfig() once here and again inside the
+    // shared fetch, so the touch below could in principle read a different resolution than the
+    // write it is renewing. Reusing the pair fetchKernelEnvelope already resolved makes that
+    // impossible by construction, not just unlikely.
+    const { envelope, apiKey, siteUrl } = await fetchKernelEnvelope(fn, args, options);
+    // TEN-3398 (follow-up): the write path announces too — see workspaceNotice.ts's doc comment
+    // on emitEffectiveTenantNotice for what this closes and why it's safe to call here.
+    await emitEffectiveTenantNotice();
+    const result = envelope.data;
     // Fire-and-forget session touch — best-effort, never blocks the write response.
     // Uses mcpFetchRaw (not kernelCall) to avoid recursion and suppress the visible spinner
     // that would appear if kernelCall were used here (background ops are silent noise).
-    if (session?.sessionId) {
+    // TEN-2923: throttled to match the server's own no-op window (shouldTouchSession) — a
+    // touch inside that window would just burn quota on a call the server already discards.
+    // WP-688 S2a review fix (thread bb1oj): `skipSessionTouch` opts a --dry-run-style caller
+    // out entirely — the door itself may not write, but this touch is a REAL session-row
+    // patch, and "no write" must mean none, not "none except telemetry".
+    if (!options?.skipSessionTouch && session?.sessionId && shouldTouchSession(session.sessionId)) {
         void mcpFetchRaw('agent.touchSession', { sessionId: session.sessionId }, apiKey, siteUrl);
     }
     return result;

package/dist/lib/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAY3C;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,UAAU,CAAC;IAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,MAAM,CAAC;IACtE,IAAI,IAAI,KAAK,mBAAmB,IAAI,IAAI,KAAK,sBAAsB;QAAE,OAAO,YAAY,CAAC;IACzF,IAAI,IAAI,KAAK,kBAAkB;QAAE,OAAO,SAAS,CAAC;IAClD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,kGAAkG;AAClG,MAAM,OAAO,QAAS,SAAQ,QAAQ;IACpC,OAAO,CAA2B;IAElC,YAAY,OAAe,EAAE,IAAa,EAAE,OAAiC;QAC3E,KAAK,CAAC,OAAO,EAAE;YACb,IAAI,EAAG,IAAuB,IAAI,SAAS,CAAC,QAAQ;YACpD,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,qEAAqE;AACrE,2EAA2E;AAC3E,yEAAyE;AACzE,iDAAiD;AACjD,IAAI,CAAC;IACH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAClE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,UAAU,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnE,mBAAmB,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAAC,MAAM,CAAC;IACP,8EAA8E;AAChF,CAAC;AAED,yEAAyE;AACzE,SAAS,mBAAmB,CAAC,GAAY,EAAE,OAAe;IACxD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,GAAG,KAAK,cAAc,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QACjE,MAAM,SAAS,GAAG,KAAK;YACrB,CAAC,CAAC,0BAA0B,KAAK,0CAA0C;gBACzE,gEAAgE;gBAChE,+DAA+D;YACjE,CAAC,CAAC,oFAAoF;gBACpF,uDAAuD;gBACvD,aAAa,IAAI,wCAAwC;gBACzD,qDAAqD;gBACrD,uEAAuE,CAAC;QAC5E,MAAM,IAAI,QAAQ,CAAC,mBAAmB,IAAI,GAAG,EAAE;YAC7C,IAAI,EAAE,SAAS,CAAC,mBAAmB;YACnC,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,OAAe,EACf,SAAS,GAAG,IAAI;IAEhB,OAAO,WAAW,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAE9D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;gBAC5C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;iBAClC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC1D,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,YAAY,CAAC,KAAK,CAAC,CAAC;YAEpB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;YACrD,CAAC;YAED,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAgF,CAAC;YAErI,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;gBACrC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,IAAI,iBAAiB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;YACvG,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,IAAI,SAAS,EAAE,CAAC;QACvE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,sEAAsE;YACtE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,cAAc,GAA2B;IAC7C,MAAM,EAAE,4BAA4B;IACpC,aAAa,EAAE,eAAe;IAC9B,gBAAgB,EAAE,mBAAmB;IACrC,gBAAgB,EAAE,gBAAgB;IAClC,gBAAgB,EAAE,gBAAgB;IAClC,eAAe,EAAE,oBAAoB;IACrC,iBAAiB,EAAE,mBAAmB;IACtC,cAAc,EAAE,kBAAkB;IAClC,oBAAoB,EAAE,kBAAkB;IACxC,oBAAoB,EAAE,iBAAiB;IACvC,oBAAoB,EAAE,oBAAoB;IAC1C,gBAAgB,EAAE,qBAAqB;IACvC,iBAAiB,EAAE,UAAU;IAC7B,OAAO,EAAE,iBAAiB;IAC1B,gBAAgB,EAAE,mBAAmB;IACrC,kBAAkB,EAAE,mBAAmB;IACvC,aAAa,EAAE,uBAAuB;CACvC,CAAC;AAEF,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,EAAU;IACrC,OAAO,cAAc,CAAC,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAe,EACf,IAA8B;IAE9B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAEjD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,EAAE;YACxC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAsF,CAAC;IAC3I,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,sBAAsB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAU,EACV,OAAgC,EAAE;IAElC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAE/B,OAAO,WAAW,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QACnC,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;gBACtC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;iBAClC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqI,CAAC;QACxK,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;YACrC,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5G,CAAC;QACD,OAAO,QAAQ,CAAC,IAAS,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CACxB,EAAU,EACV,IAA6B,EAC7B,MAAc,EACd,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,EAAU,EACV,OAAgC,EAAE;IAElC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAE/B,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,aAAa,EAAE,UAAU,MAAM,EAAE;KAClC,CAAC;IACF,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,oBAAoB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAI,KAAK,EAAE,KAAK,IAAI,EAAE;QACpD,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;gBACtC,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqI,CAAC;QACxK,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;YACrC,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5G,CAAC;QACD,OAAO,QAAQ,CAAC,IAAS,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,wFAAwF;IACxF,oFAAoF;IACpF,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;QACvB,KAAK,WAAW,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5F,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,uFAAuF;AACvF,sFAAsF;AACtF,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AACvF,OAAO,EAAE,sCAAsC,IAAI,2CAA2C,EAAE,MAAM,+DAA+D,CAAC;AACtK,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1E,4FAA4F;AAC5F,8FAA8F;AAC9F,mDAAmD;AACnD,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE1G,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,+BAA+B,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAClH,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAA0B,MAAM,iBAAiB,CAAC;AAEzF;iGACiG;AACjG,mbAAmb;AACnb,MAAM,sCAAsC,GAAG,IAAI,GAAG,CAAS,2CAA2C,CAAC,CAAC;AAE5G,iGAAiG;AACjG,sFAAsF;AACtF,8FAA8F;AAC9F,+FAA+F;AAC/F,+FAA+F;AAC/F,4IAA4I;AAC5I,6FAA6F;AAC7F,4FAA4F;AAC5F,yFAAyF;AACzF,4FAA4F;AAC5F,2FAA2F;AAC3F,4IAA4I;AAC5I,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AACnF,MAAM,UAAU,8BAA8B,CAAC,IAAa;IAC1D,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAc,CAAC,IAAI,sCAAsC,CAAC,GAAG,CAAC,IAAc,CAAC,CAAC;AACnI,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,UAAU,CAAC;IAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,cAAc,IAAI,sCAAsC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,SAAS,CAAC,mBAAmB;QAAE,OAAO,MAAM,CAAC;IACpK,IACE,IAAI,KAAK,mBAAmB,IAAI,IAAI,KAAK,sBAAsB;QAC/D,IAAI,KAAK,wBAAwB,IAAI,IAAI,KAAK,+BAA+B,IAAI,IAAI,KAAK,uBAAuB,IAAI,IAAI,KAAK,4BAA4B;QAC1J,mKAAmK;QACnK,IAAI,KAAK,uBAAuB,IAAI,IAAI,KAAK,qBAAqB;QAClE,qKAAqK;QACrK,IAAI,KAAK,4BAA4B,IAAI,IAAI,KAAK,wBAAwB,IAAI,2DAA2D;QACzI,8LAA8L;QAC9L,IAAI,KAAK,yBAAyB;QAClC,OAAO,YAAY,CAAC;IACtB,IAAI,IAAI,KAAK,kBAAkB;QAAE,OAAO,SAAS,CAAC;IAClD,sFAAsF;IACtF,oFAAoF;IACpF,wBAAwB;IACxB,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACtC,mFAAmF;IACnF,4FAA4F;IAC5F,8FAA8F;IAC9F,6FAA6F;IAC7F,2FAA2F;IAC3F,4EAA4E;IAC5E,IAAI,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC,WAAW,CAAC;IAAC,IAAI,IAAI,KAAK,wBAAwB;QAAE,OAAO,SAAS,CAAC,iBAAiB,CAAC,CAAC,2BAA2B;IACpK,OAAQ,IAAmC,IAAI,SAAS,CAAC,QAAQ,CAAC;AACnE,CAAC;AAED,kGAAkG;AAClG,MAAM,OAAO,QAAS,SAAQ,QAAQ;IACpC,OAAO,CAA2B;IAClC,sFAAsF;IACtF,iBAAiB,CAAU;IAAC,qBAAqB,CAAY,CAAC,kEAAkE;IAEhI,YAAY,OAAe,EAAE,IAAa,EAAE,OAAiC,EAAE,iBAA0B,EAAE,qBAAgC;QACzI,KAAK,CAAC,OAAO,EAAE;YAChB,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC;YACzB,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC;YACjC,yFAAyF;YACzF,0GAA0G;YAC1G,QAAQ,EAAE,IAAI,KAAK,cAAc;gBAC/B,CAAC,CAAC,sLAAsL;gBACxL,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,mEAAmE;SACjK,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAAC,IAAI,CAAC,qBAAqB,GAAG,qBAAqB,CAAC;IACjG,CAAC;CACF;AAED,kKAAkK;AAClK,OAAO,EAAE,kBAAkB,EAA0B,MAAM,iBAAiB,CAAC;AAO7E,qEAAqE;AACrE,2EAA2E;AAC3E,yEAAyE;AACzE,iDAAiD;AACjD,IAAI,CAAC;IACH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAClE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,UAAU,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnE,mBAAmB,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAAC,MAAM,CAAC;IACP,8EAA8E;AAChF,CAAC;AAED,yEAAyE;AACzE,SAAS,mBAAmB,CAC1B,GAAY,EACZ,OAAe;AACf,yFAAyF;AACzF,sFAAsF;AACtF,gGAAgG;AAChG,KAAwD;IAExD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAE7D,2FAA2F;IAC3F,wFAAwF;IACxF,IAAI,KAAK,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,MAAM,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAElG,IAAI,GAAG,KAAK,cAAc,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QACjE,MAAM,SAAS,GAAG,KAAK;YACrB,CAAC,CAAC,0BAA0B,KAAK,0CAA0C;gBACzE,gEAAgE;gBAChE,+DAA+D;YACjE,CAAC,CAAC,oFAAoF;gBACpF,uDAAuD;gBACvD,aAAa,IAAI,wCAAwC;gBACzD,qDAAqD;gBACrD,uEAAuE,CAAC;QAC5E,MAAM,IAAI,QAAQ,CAAC,mBAAmB,IAAI,GAAG,EAAE;YAC7C,IAAI,EAAE,SAAS,CAAC,mBAAmB;YACnC,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAOD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,OAAe,EACf,SAAS,GAAG,uBAAuB,CAAC,kBAAkB,CAAC;IAEvD,OAAO,WAAW,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAE9D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;gBAC5C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;iBAClC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC1D,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,4GAA4G;YAC5G,wBAAwB,CAAC,GAAG,CAAC,CAAC;YAE9B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;YACrD,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAmB,GAAG,CAAC,CAAC;YAElE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;gBACrC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,IAAI,iBAAiB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;YACvG,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,IAAI,SAAS,EAAE,CAAC;QACvE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,sEAAsE;YACtE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,cAAc,GAA2B;IAC7C,MAAM,EAAE,4BAA4B;IACpC,aAAa,EAAE,eAAe;IAC9B,gBAAgB,EAAE,mBAAmB;IACrC,gBAAgB,EAAE,gBAAgB;IAClC,gBAAgB,EAAE,gBAAgB;IAClC,eAAe,EAAE,oBAAoB;IACrC,iBAAiB,EAAE,mBAAmB;IACtC,cAAc,EAAE,kBAAkB;IAClC,oBAAoB,EAAE,kBAAkB;IACxC,oBAAoB,EAAE,iBAAiB;IACvC,oBAAoB,EAAE,oBAAoB;IAC1C,gBAAgB,EAAE,qBAAqB;IACvC,iBAAiB,EAAE,UAAU;IAC7B,OAAO,EAAE,iBAAiB;IAC1B,gBAAgB,EAAE,mBAAmB;IACrC,kBAAkB,EAAE,mBAAmB;IACvC,aAAa,EAAE,uBAAuB;IACtC,gBAAgB,EAAE,wBAAwB;IAC1C,mBAAmB,EAAE,mBAAmB;IACxC,mBAAmB,EAAE,2BAA2B;CACjD,CAAC;AAEF,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,EAAU;IACrC,OAAO,cAAc,CAAC,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAe,EACf,IAA8B;IAE9B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAEtE,yFAAyF;IACzF,oFAAoF;IACpF,cAAc,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,eAAe,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAErG,yFAAyF;IACzF,sFAAsF;IACtF,2FAA2F;IAC3F,2FAA2F;IAC3F,uFAAuF;IACvF,yFAAyF;IACzF,mEAAmE;IACnE,4FAA4F;IAC5F,yFAAyF;IACzF,+FAA+F;IAC/F,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,EAAE;YACxC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAEG,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAsF,CAAC;IAC/I,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,sBAAsB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAElC;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,IAA6B;IACpD,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,MAAM,iBAAiB,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,OAAO,iBAAiB,IAAI,iBAAiB,KAAK,OAAO,EAAE,SAAS;QAClE,CAAC,CAAC,sBAAsB,CAAC,iBAAiB,CAAC;QAC3C,CAAC,CAAC,OAAO,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,mBAAmB,CAChC,EAAU,EACV,IAA6B,EAC7B,OAA2B;IAE3B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;IACxC,8FAA8F;IAC9F,0FAA0F;IAC1F,yFAAyF;IACzF,oFAAoF;IACpF,gDAAgD;IAChD,uBAAuB,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,+BAA+B,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAE7C,0FAA0F;IAC1F,yFAAyF;IACzF,gFAAgF;IAChF,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;QACpE,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;gBACtC,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACrC,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;oBACjC,4EAA4E;oBAC5E,aAAa,EAAE,mBAAmB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAI,GAAG,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;YACnC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC,CAAC;QAC5K,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAEb,qGAAqG;IACrG,kGAAkG;IAClG,+FAA+F;IAC/F,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAU,EACV,OAAgC,EAAE,EAClC,OAA2B;IAE3B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,mBAAmB,CAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACrE,MAAM,yBAAyB,EAAE,CAAC,CAAC,yDAAyD;IAC5F,OAAO,QAAQ,CAAC,IAAS,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAU,EACV,OAAgC,EAAE,EAClC,OAA2B;IAE3B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,mBAAmB,CAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACrE,MAAM,yBAAyB,EAAE,CAAC,CAAC,yDAAyD;IAC5F,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CACxB,EAAU,EACV,IAA6B,EAC7B,MAAc,EACd,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,sFAAsF;YACtF,iFAAiF;YACjF,kFAAkF;YAClF,8DAA8D;YAC9D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;YACxD,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,EAAU,EACV,OAAgC,EAAE,EAClC,OAA2B;IAE3B,8FAA8F;IAC9F,8FAA8F;IAC9F,sEAAsE;IACtE,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAE9B,+FAA+F;IAC/F,4FAA4F;IAC5F,2FAA2F;IAC3F,yFAAyF;IACzF,iDAAiD;IACjD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,mBAAmB,CAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACtF,4FAA4F;IAC5F,oFAAoF;IACpF,MAAM,yBAAyB,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAS,CAAC;IAElC,gFAAgF;IAChF,wFAAwF;IACxF,oFAAoF;IACpF,sFAAsF;IACtF,wFAAwF;IACxF,yFAAyF;IACzF,qFAAqF;IACrF,qEAAqE;IACrE,IAAI,CAAC,OAAO,EAAE,gBAAgB,IAAI,OAAO,EAAE,SAAS,IAAI,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9F,KAAK,WAAW,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5F,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/lib/collectionRegistry.d.ts

@@ -14,9 +14,39 @@ export interface CollectionMeta {
     slug: string;
     idPrefix?: string;
     classificationCheck?: string;
+    classificationSignals?: string[];
     navGroup?: string;
     governed?: boolean;
+    governanceFunction?: string;
+    /** WP-707 S1 round 3 (operator ruling #13): the collection's declared canonical kind — lets
+     *  `--entry-type` derive its drawer from the SAME 1:1 registry the server enforces
+     *  (`getRequiredCollectionSlugForKind`, convex/lib/seedTypeRegistry.ts), instead of a
+     *  hand-picked pair of literal branches. Present on the live `chain.listCollections` payload
+     *  (`collections.defaultCanonicalKey`); populated on the offline SEED fallback only where
+     *  added below. */
+    defaultCanonicalKey?: string;
 }
+/**
+ * SEED — the OFFLINE FAIL-OPEN FALLBACK only (WP-480 S2, TEN-2219).
+ * The online path derives from `chain.listCollections` (getCollections below);
+ * this snapshot exists solely so CLI commands keep working when the backend is
+ * unreachable. It therefore only needs day-zero accuracy, and is content-pinned
+ * against the canonical day-zero seed truth —
+ * `convex/lib/seedClassificationRegistry.ts` on the {slug, idPrefix} projection
+ * (see src/__tests__/collection-registry-seed-drift.test.ts). Two carve-outs
+ * have no canonical counterpart and are excluded from the pin:
+ *   - `work-packages → BET` (BET-230 rename backward compat; canonical maps only WP).
+ *   - `objectives → KEY` (P1 review PRRT_kwDORS4ils6cUz6M, WP-686 S6; rationale corrected PR
+ *     #824, 2026-09-04): the canonical registry flipped `objectives`'s idPrefix from KEY to OBJ
+ *     in place (S5, TASK-91) rather than adding a parallel row, so there is no canonical KEY
+ *     entry to pin against — but a version-skewed CLI running OFFLINE (this SEED's only use
+ *     case) against a STALE local cache or export predating the fleet-wide id-rewrite (now
+ *     `applied` everywhere — live-scope-subset, live:8 dead:0, per artifact generatedAt
+ *     2026-09-04T19:43:27.412Z; wp686_key_to_obj_prefix_rewrite.md no longer exists) can still
+ *     see `KEY`, so `pb capture "KEY: ..."` still needs to route to `objectives`, same reasoning
+ *     as the BET alias above.
+ */
+export declare const SEED: CollectionMeta[];
 /**
  * Fetch all collections for the current workspace.
  * Module-scope memoized — calls kernelCall once per process, then returns
@@ -29,10 +59,15 @@ export declare function getCollections(): Promise<CollectionMeta[]>;
  */
 export declare function getPrefixToCollection(): Promise<Record<string, string>>;
 /**
- * Returns slugs of collections that accept a date field during capture.
- * Derived from classificationCheck presence when available (a non-empty
- * classificationCheck indicates the collection is content-dated).
- * Falls back to a hardcoded seed set when field metadata is absent.
+ * WP-707 S1 round 3 (operator ruling #13): build a canonicalKey → collection slug map from the
+ * runtime registry — the CLI-side mirror of `getRequiredCollectionSlugForKind`
+ * (convex/lib/seedTypeRegistry.ts). Used by capture.ts's `--entry-type` fast path so ANY kind
+ * with its own 1:1 drawer resolves automatically, instead of a hand-picked pair of literal
+ * branches that needs a new one hand-added for every future drawer. Only a kind with EXACTLY ONE
+ * collection declaring it as `defaultCanonicalKey` resolves — consistent with the
+ * one-type-one-collection invariant this PR establishes server-side; a kind with zero or more
+ * than one owner slug resolves to undefined so the caller falls through to server-side
+ * classification instead of guessing.
  */
-export declare function getDatedCollections(): Promise<Set<string>>;
+export declare function getCanonicalKeyToCollection(): Promise<Record<string, string>>;
 //# sourceMappingURL=collectionRegistry.d.ts.map